0

I'm hosting a mail server for a couple different domains. Recently, the password of one of the users was guessed/hacked and the account was used to send out a couple hundred thousand messages before I noticed and was able to shut it down, which got the entire server blacklisted

I'd like to put a limit in qmail to rate-limit outgoing email on a per user/domain/time basis, but so far have not been able to find any built in functionality for that.

Any techniques you know of would be useful. One option I've come across is to send outbound email through SpamAssassin, but I'm concerned about blocking legit messages.

5 Answers 5

1

There's some sort of throttle patch available for Qmail that fits your description. I doubt there's built in functionality without patching Qmail, as Qmail is, ahem, perfectly coded as is.

Please take a look at this discussion of various MTAs, particularly the note about Qmail. Bear in mind that this discussion is from 6 years ago, and what was said about Qmail then is even more true. This would perhaps not be in your short or medium term planning, but migrating from Qmail should be something to consider, particularly if you have to apply a bunch of sort of random patches to get it to do what you want it to do.

Hmm, the discussion on how to do something similar in Postfix is to use the policyd add-on. A glance at that project suggests it can be used with different MTAs, so possibly you can convince Qmail to use it.

1

It worked excellent, thank you!

You should also include the next line following the first grep:

grep "$(date +"%b %d")" /var/log/maillog| grep submission:| awk -Fsuccess {'print $2'} |awk -F: {'print $1'} | sort | uniq -c | sort -n | grep -v (unknown) | awk {'print $1"|"$2'}

So you can block simple unencrypted smtp submissions also.

Greetings!

1

Also you can monitor outgoing mail with swatch, when swatch detect qmail-send at maximum (like: remote 30/30) send you an alert.

You can use The tcpserver limits patch: gives tcpserver the ability to reject connections when the server's load average is above a certain number, when more than a certain number of connections are received from the same IP address, or when more than a certain number of connections are received from machines in the same class-C block (i.e. the "first three numbers" in their IP addresses are the same. "1.2.3.4" and "1.2.3.100" are in the same class-C block.) https://qmail.jms1.net/ucspi-tcp/

0

This script limit the number of emails sent ​​per user per day. If the user reached a maximum preset, the script will change the password and an email is sent to the administrator.

To install:

  1. You must have qmt with spamdyke installed.
  2. Save and execute permissions to this script as: /home/vpopmail/bin/qmail-antispam
  3. Create this file: /etc/qmailadmin/qmail-spam/blacklist
  4. In the crontab add

    */5 * * * * /home/vpopmail/bin/qmail-antispam >> /var/log/maillog 2>&1
    

Review the logs so to check if it works:

tail -f /var/log/maillog | grep "qmail-antispam"

#!/bin/sh
#Qmail Toaster AntiSpam - qmail limit number of emails sent by user by day
#PseudoAntiSpam - Fake Antispam - Toxic Antispam - LogBased Antispam
#Prevent when an attacker steal a user password and abuse the server.
#
#Español Spanish
#Script para limitar la cantidad de envios realizados por usuario por dia. Si el usuario alcanzo un maximo prefijado se la cambia el password y se envia un correo al administrador.
#Este script previene los casos en los que un atacante roba una clave y abusa de nuestro server haciendo envios masivos. Normalmente estos envios masivos implican multiples autenticaciones y contando la cantidad de envios con autenticacion se identifica el ataque, y se le cambia el password para frenar esos envios.
#
#Para instalar:
#1- Guardar y dar permisos de ejecucion a este script como: /home/vpopmail/bin/qmail-antispam
#2- Crear este archivo: /etc/qmailadmin/qmail-antispam/blacklist
#3- En el crontab agregar
#*/5 * * * * /home/vpopmail/bin/qmail-antispam >> /var/log/maillog 2>&1
#
#
#Revisar los logs asi para verificar que este funcionando
#tail -f /var/log/maillog | grep "qmail-antispam"
#
#English Ingles
#Google translate:
#
#This script limit the number of emails sent ​​per user per day. If the user reached a maximum preset, the script will change the password and an email is sent to the administrator.
#
# To install:
# 1 - Save and execute permissions to this script as: /home/vpopmail/bin/qmail-antispam
# 2 - Create this file: /etc/qmailadmin/qmail-spam/blacklist
# 3 - In the crontab add
# * / 5 **** /home/vpopmail/bin/qmail-antispam >> /var/log/maillog 2>&1
#
#
# Review the logs so to check if it works:
# tail-f / var / log / maillog | grep "qmail-antispam"
#
#
#Author: 3.14
#Contact: [email protected]

#Configuracion / Config
MAILLOG="/var/log/maillog"
MAX_CORREOS=3000
ID_SERVER="ID_SERVER"
[email protected]
LISTA_NEGRA=/etc/qmailadmin/qmail-antispam/blacklist
VUSERINFO="/home/vpopmail/bin/vuserinfo"
VPASSWD="/home/vpopmail/bin/vpasswd"
AUX=$(mktemp)

echo "$(date) qmail-antispam : Revisando logs"

function LstUsers
{
    grep "$(date +"%b %d")" /var/log/maillog| grep auth: | grep ALL| awk -Fauth: {'print $2'} | awk {'print $1'} | sort | uniq -c | sort -n | grep -v \(unknown\) | awk {'print $1"|"$2'}
}

LstUsers >$AUX

#cat $AUX

for i in $(cat $AUX); do

    cantidad=$(echo $i | awk -F\| {'print $1'})
    usuario=$(echo $i | awk -F\| {'print $2'})

    if [ $cantidad -gt $MAX_CORREOS ]; then

        #echo "$(date) Limite de autenticaciones exedido: $usuario"
        #echo "$(date) Verificando si $usuario se encuentra suspendido"

        if [ "$(cat $LISTA_NEGRA | grep "$(date +"%b %d %Y")" | grep $usuario)" == "" ]; then
            echo "$(date) qmail-antispam : Suspendiendo al usuario: $usuario envios: $cantidad maximo_permitido: $MAX_CORREOS" >> $MAILLOG
            password_capturado=$($VUSERINFO $usuario | grep "clear passwd" | awk -F: {'print $2'})
            echo "$(date +"%b %d %Y")" $usuario $password_capturado>>$LISTA_NEGRA
            echo -e "Fecha: $(date) \nUsuario: $usuario \nPassword: $password_capturado \nEnvios: $cantidad" | mail -s "Aviso de spam en el $ID_SERVER" "$CONTACTO"
            $VPASSWD $usuario -r                
        fi

    fi

done

echo "$(date) qmail-antispam : Fin de revision"
0

Also add this line to protect your server from locally authenticated users:

grep "$(date +"%b %_d")" /var/log/maillog |
grep auth: |
grep ALL |
grep '127.0.0.1' |
awk -Ffrom\: {'print $2'} |
awk -Fto\: {'print $1'} |
sort | uniq -c | sort -n | grep -v bounce |
awk {'print $1"|"$2'}

Greetings!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .